rds: annotate data-race around rs_seen_congestion

[PATCH net] rds: annotate data-race around rs_seen_congestion

Posted by Jiayuan Chen 2 days, 18 hours ago

rs_seen_congestion is read in rds_poll() and written in rds_sendmsg()
and rds_poll() without any lock.  Use READ_ONCE()/WRITE_ONCE() to
annotate these lockless accesses and silence KCSAN.

Fixes: b98ba52f96e7 ("RDS: only put sockets that have seen congestion on the poll_waitq")
Reported-by: syzbot+fbf3648ae7f5bdb05c59@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a0f8d94.050a0220.6b33c.0000.GAE@google.com/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/rds/af_rds.c | 4 ++--
 net/rds/send.c   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 76f625986a7f..93b2da63ed42 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -219,7 +219,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
 
 	poll_wait(file, sk_sleep(sk), wait);
 
-	if (rs->rs_seen_congestion)
+	if (READ_ONCE(rs->rs_seen_congestion))
 		poll_wait(file, &rds_poll_waitq, wait);
 
 	read_lock_irqsave(&rs->rs_recv_lock, flags);
@@ -247,7 +247,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
 
 	/* clear state any time we wake a seen-congested socket */
 	if (mask)
-		rs->rs_seen_congestion = 0;
+		WRITE_ONCE(rs->rs_seen_congestion, 0);
 
 	return mask;
 }
diff --git a/net/rds/send.c b/net/rds/send.c
index d8b14ff9d366..e5d58c29aabe 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1388,7 +1388,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
 
 	ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
 	if (ret) {
-		rs->rs_seen_congestion = 1;
+		WRITE_ONCE(rs->rs_seen_congestion, 1);
 		goto out;
 	}
 	while (!rds_send_queue_rm(rs, conn, cpath, rm, rs->rs_bound_port,
-- 
2.43.0

Re: [PATCH net] rds: annotate data-race around rs_seen_congestion

Posted by Allison Henderson 2 days, 14 hours ago

On Fri, 2026-05-22 at 09:16 +0800, Jiayuan Chen wrote:
> rs_seen_congestion is read in rds_poll() and written in rds_sendmsg()
> and rds_poll() without any lock.  Use READ_ONCE()/WRITE_ONCE() to
> annotate these lockless accesses and silence KCSAN.
> 
> Fixes: b98ba52f96e7 ("RDS: only put sockets that have seen congestion on the poll_waitq")
> Reported-by: syzbot+fbf3648ae7f5bdb05c59@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a0f8d94.050a0220.6b33c.0000.GAE@google.com/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Hi Jiayuan,

I was about to send the same patch, so no complaints here.  Thanks for catching this.
Reviewed-by: Allison Henderson <achender@kernel.org> 
Tested-by: Allison Henderson <achender@kernel.org>

Allison
> ---
>  net/rds/af_rds.c | 4 ++--
>  net/rds/send.c   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
> index 76f625986a7f..93b2da63ed42 100644
> --- a/net/rds/af_rds.c
> +++ b/net/rds/af_rds.c
> @@ -219,7 +219,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
>  
>  	poll_wait(file, sk_sleep(sk), wait);
>  
> -	if (rs->rs_seen_congestion)
> +	if (READ_ONCE(rs->rs_seen_congestion))
>  		poll_wait(file, &rds_poll_waitq, wait);
>  
>  	read_lock_irqsave(&rs->rs_recv_lock, flags);
> @@ -247,7 +247,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
>  
>  	/* clear state any time we wake a seen-congested socket */
>  	if (mask)
> -		rs->rs_seen_congestion = 0;
> +		WRITE_ONCE(rs->rs_seen_congestion, 0);
>  
>  	return mask;
>  }
> diff --git a/net/rds/send.c b/net/rds/send.c
> index d8b14ff9d366..e5d58c29aabe 100644
> --- a/net/rds/send.c
> +++ b/net/rds/send.c
> @@ -1388,7 +1388,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
>  
>  	ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
>  	if (ret) {
> -		rs->rs_seen_congestion = 1;
> +		WRITE_ONCE(rs->rs_seen_congestion, 1);
>  		goto out;
>  	}
>  	while (!rds_send_queue_rm(rs, conn, cpath, rm, rs->rs_bound_port,